Guides/How to handle GDPR deletion for form data

How to handle GDPR deletion for form data

Delete by email. One API call. Gone.

Updated March 2026

Someone asks you to delete their data. GDPR says you do it. Sutrena has a deletion endpoint that removes submissions matching a specific email address. One call, the data is gone. This guide covers the call, verification, and what to think about.

1. Identify the user and their data

When you get a deletion request, figure out which forms the user submitted to. Search submissions by email across your forms.

# List submissions for a specific form filtered by email:
curl "https://sutrena.com/api/forms/frm_xyz789/[email protected]" \
  -H "Authorization: Bearer st_live_your_key"

# Check multiple forms by listing all forms first:
curl https://sutrena.com/api/forms \
  -H "Authorization: Bearer st_live_your_key"

2. Delete submissions by email

Call the deletion endpoint with the email. Permanently removes all submissions from that user for the specified form. Irreversible.

curl -X DELETE \
  "https://sutrena.com/api/forms/frm_xyz789/[email protected]" \
  -H "Authorization: Bearer st_live_your_key"

# Response:
# {
#   "deleted": 3,
#   "message": "3 submissions deleted for [email protected]"
# }

3. Verify the deletion

Query for that email again to confirm nothing remains. Document it for your compliance records.

# Verify no submissions remain:
curl "https://sutrena.com/api/forms/frm_xyz789/[email protected]" \
  -H "Authorization: Bearer st_live_your_key"

# Response should show empty results:
# { "submissions": [], "total": 0 }

FAQ

Is the deletion permanent?

Yes. No soft-delete, no recycle bin. Once you call it, it is gone. Make sure you have confirmed the request first.

Can I delete a single submission by ID?

Yes. DELETE /api/forms/:formId/submissions/:submissionId removes one specific submission.

How long does deletion take?

Immediate. The call is synchronous. Returns the count of what was deleted.

Do I need to delete data from Nishkala separately?

No. Sutrena handles all the storage. The deletion API takes care of everything.

Related

Form submissions API →Export before deleting →What is a headless form backend? →Plan limits →

What is Sutrena?

Sutrena is the web runtime for AI agents. Forms, Pages, Analytics, Webhooks, Automations — all through 67 MCP tools and one REST API. Your agent creates web artifacts, humans interact with them, and your agent gets the data back. Use any one feature or all of them together.

Pages

Deploy HTML instantly

Forms

Collect structured data

Automations

DSL-based pipelines with 14 step types

Analytics

Privacy-first, no cookies

Webhooks

Slack, Discord, Telegram

Get started in two API calls

1. Get a trial key (no auth, no signup)

curl -X POST https://sutrena.com/api/trial

2. Create anything — a page, form, automation, or analytics site

# Create a form
curl -X POST https://sutrena.com/api/forms \
  -H "Authorization: Bearer st_trial_xxx" \
  -H "Content-Type: application/json" \
  -d '{"name": "waitlist", "fields": [{"name": "email", "label": "Email", "type": "email", "required": true}]}'

# Or deploy a page
curl -X POST https://sutrena.com/api/pages \
  -H "Authorization: Bearer st_trial_xxx" \
  -H "Content-Type: application/json" \
  -d '{"slug": "index", "title": "My Site", "html": "<h1>Live</h1>"}'
/llms.txt/api/schema/llms-full.txt/.well-known/mcp.json

Ready to build?

Get a trial API key instantly with no signup, or create an account for the full experience.

Start buildingAgent docs
How to handle GDPR deletion for form data — Sutrena | Sutrena